CVE-2023-39810
High · 7.8CVSS
7.8
EPSS
0.8%
Published
Aug 28, 2023
CISA due date
—
Cloudanix analysis
Very little information has been released about this security issue, so its real-world risk cannot yet be assessed.
- Exploitation
- Other
- Attacker needs
- Other
- Complexity
- Theoretical
- Impact
- Full Compromise
- Component
- Other
- Class
- Other
- Remediation
- Other
- Effort
- Other
- Patch risk
- Other
What it actually does
Insufficient public details available to determine the technical nature or root cause of the flaw.
Why it matters to the business
Low observed exploitability and no known active exploitation campaigns reduce immediate operational risk, though the absence of affected product details limits precise scoping.
How an attack unfolds
No exploitation methods or threat actor activity have been publicly documented for this issue.
How to fix it
Monitor vendor advisories for any forthcoming patches or mitigation steps once affected components are identified.
How to confirm the fix worked
Re-evaluate once product mappings or fixed versions are published; currently no validation steps can be derived.
How to detect it
No specific log sources or indicators can be derived from available data; continue routine security monitoring.
What your security team should do
- Track CVE updates for product and version information
- Maintain standard vulnerability monitoring processes given low EPSS and non-KEV status
The record
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | busybox | 0 | No fix |
| Debian:12 | busybox | 0 | No fix |
| Debian:13 | busybox | 0 | No fix |
| Ubuntu:20.04:LTS | busybox | 0 | No fix |
| Ubuntu:22.04:LTS | busybox | 0 | No fix |
| Ubuntu:24.04:LTS | busybox | 0 | No fix |
| Ubuntu:24.10 | busybox | 0 | No fix |
| Ubuntu:25.04 | busybox | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | busybox | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | busybox | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | busybox | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | busybox | 0 | No fix |
Related vulnerabilities
- CVE-2014-4607 Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07… Also affects busybox
- CVE-2011-5325 Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5… Also affects busybox
- CVE-2016-2148 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… Also affects busybox
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
- CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22
- CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. CWE-22